/usr/sbin/matchpathcon command to check if files and directories have the correct SELinux context. From the matchpathcon(8) manual page: "matchpathcon queries the system policy and outputs the default security context associated with the file path."[11]. The following example demonstrates using the /usr/sbin/matchpathcon command to verify that files in /var/www/html/ directory are labeled correctly:
touch /var/www/html/file{1,2,3} command to create three files (file1, file2, and file3). These files inherit the httpd_sys_content_t type from the /var/www/html/ directory:
# touch /var/www/html/file{1,2,3}
# ls -Z /var/www/html/
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file1
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file2
-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 file3
chcon -t samba_share_t /var/www/html/file1 command to change the file1 type to samba_share_t. Note: the Apache HTTP Server can not read files or directories labeled with the samba_share_t type.
/usr/sbin/matchpathcon -V option compares the current SELinux context to the correct, default context in SELinux policy. Run the /usr/sbin/matchpathcon -V /var/www/html/* command to check all files in the /var/www/html/ directory:
$ /usr/sbin/matchpathcon -V /var/www/html/* /var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0 /var/www/html/file2 verified. /var/www/html/file3 verified.
/usr/sbin/matchpathcon command explains that file1 is labeled with the samba_share_t type, but should be labeled with the httpd_sys_content_t type:
/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0
file1, as the Linux root user, run the /sbin/restorecon -v /var/www/html/file1 command:
# /sbin/restorecon -v /var/www/html/file1 restorecon reset /var/www/html/file1 context unconfined_u:object_r:samba_share_t:s0->system_u:object_r:httpd_sys_content_t:s0
[11] The matchpathcon(8) manual page, as shipped with the libselinux-utils package in Red Hat Enterprise Linux, is written by Daniel Walsh. Any edits or changes in this version were done by Murray McAllister.